telegram-lite-grabber (PyPI) · Malicious Code
Affects telegram-lite-grabberSource GCVE Database
Malicious package : remove telegram-lite-grabber and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 10:07 UTC
Malicious package
Published to PyPI · OSV MAL-2026-6051
What to do
Remove telegram-lite-grabber from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPItelegram-lite-grabber | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The 'telegram-lite-grabber' package on PyPI version 1.0.0 is identified as malicious software designed to exfiltrate data from the Telegram application, specifically targeting Telegram sessions. Although automated scans did not detect install-time or import-time harmful code, the package's behavior includes collecting and sending Telegram session data to a remote location. This package is categorized as malicious due to its intent to steal information. There is no known patch or remediation available, and no exploits have been reported in the wild to date.